feat: govern task-local quick actions

2026-08-19 18:47:46 +02:00
parent d44ed78e5c
commit 5a906185a6
10 changed files with 139 additions and 23 deletions
@@ -37,10 +37,17 @@ owner module.

 Quick Access is not an authorization boundary. Every contribution keeps its
 own permission requirements and View surface. Full-page routes remain the
-canonical fallback. Launch context version 1 contains only the tenant/account
-identity, safe active-object reference, acting-assignment identifiers,
-temporal selection, exact View identity, and return route. Cross-tenant object
-references are discarded and unknown context versions are ignored. The
-destination reauthorizes every read and effect. Disabling this module removes
-the rail without making any domain state unavailable through its owning
-module.
+canonical fallback. Launch-context version 2 contains only the tenant/account
+identity, a reference-contract-version-1 active object, acting-assignment
+identifiers, temporal selection, exact View identity, View recommendations or
+focus, and a safe return route. Cross-tenant object references are discarded
+and unknown versions fail closed. View focus applies only when at least one
+focused tool is currently enabled, context-compatible, and authorized; a
+recommendation only changes ordering and emphasis.
+
+Each renderer performs owner-side reads and effects and explicitly reports
+either a result-contract-version-1 completion with a typed owner reference or
+a cancellation reason. Closing the drawer is not completion. The host may
+listen for that correlated result while its unsaved page state remains mounted.
+Disabling this module removes the rail without making any domain state
+unavailable through its owning module.